stonewareslord/treestyletab
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #349 from Infocatcher/patch-11

Browse Source 
Use checkLoadURIStrWithPrincipal() instead of checkLoadURIStr()
This commit is contained in:
YUKI "Piro" Hiroshi 2012-10-12 12:16:41 -07:00
commit c5bb7ec8ad
1 changed files with 22 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
modules/tabbarDNDObserver.js
View File

@ -1117,19 +1117,29 @@ catch(e) {
}, },
securityCheck : function TabbarDND_securityCheck(aURI, aEvent) securityCheck : function TabbarDND_securityCheck(aURI, aEvent)
{ {
// See dragDropSecurityCheck() in chrome://global/content/nsDragAndDrop.js
let session = this.treeStyleTab.currentDragSession; let session = this.treeStyleTab.currentDragSession;
let (sourceDoc = session ? session.sourceDocument : null) { if (!session) { //TODO: use some fake nodePrincipal?
let sourceURI = sourceDoc ? sourceDoc.documentURI : 'file:///' ; aEvent.stopPropagation();
let normalizedURI = this.treeStyleTab.makeURIFromSpec(aURI); throw 'Drop of ' + aURI + ' denied: no drag session.';
if (normalizedURI && sourceURI.indexOf('chrome://') < 0) { }
try { let normalizedURI;
SecMan.checkLoadURIStr(sourceURI, normalizedURI.spec, Ci.nsIScriptSecurityManager.STANDARD); try {
} normalizedURI = this.treeStyleTab.makeURIFromSpec(aURI);
catch(e) { }
aEvent.stopPropagation(); catch(e) {
throw 'Drop of ' + aURI + ' denied.'; }
} if (!normalizedURI)
} return;
let sourceDoc = session.sourceDocument;
let principal = sourceDoc ? sourceDoc.nodePrincipal
: SecMan.getSimpleCodebasePrincipal(this.treeStyleTab.IOService.newURI("file:///", null, null));
try {
SecMan.checkLoadURIStrWithPrincipal(principal, normalizedURI.spec, Ci.nsIScriptSecurityManager.STANDARD);
}
catch(e) {
aEvent.stopPropagation();
throw 'Drop of ' + aURI + ' denied.';
} }
}, },